Complete physical simulation of the entangling-probe attack on the BB84 protocol 
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We have used deterministic single-photon two qubit (SPTQ) quantum logic to implement the 
most powerful individual-photon attack against the Bennett-Brassard 1984 (BB84) quantum key 
distribution protocol. Our measurement results, including physical source and gate errors, are 
in good agreement with theoretical predictions for the Renyi information obtained by Eve as a 
function of the errors she imparts to Alice and Bob's sifted key bits. The current experiment is a 
physical simulation of a true attack, because Eve has access to Bob's physical receiver module. This 
experiment illustrates the utility of an efficient deterministic quantum logic for performing realistic 
physical simulations of quantum information processing functions. 
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In 1984 Bennett and Brassard 1| proposed a protocol 
(BB84) for quantum key distribution (QKD) in which 
the sender (Ahce) transmits single-photon pulses to the 
receiver (Bob) in such a way that security is vouchsafed 
by physical laws. Since then, BB84 has been the subject 
of many security analyses [2], particularly for configu- 
rations that involve nonideal operating conditions, such 
as the use of weak laser pulses in lieu of single photons. 
A more fundamental question is how much information 
the eavesdropper (Eve) can gain under ideal BB84 oper- 
ating conditions. Papers by Fuchs and Peres [3j, Slut- 
sky et al. and Brandt [3] show that the most pow- 
erful individual-photon attack can be accomplished with 
a controUed-NOT (cnot) gate. As illustrated in Fig. 1, 
Eve supplies the target qubit to the cnot gate, which 
entangles it with the BB84 qubit that Alice is sending 
to Bob. Eve then makes her measurement of the target 
qubit to obtain information on the shared key bit at the 
expense of imposing detectable errors between Alice and 
Bob 



Eve 




FIG. 1: (Color online) Block diagram of the Fuchs-Peres- 
Brandt probe for attacking BB84 QKD. 

We have recently shown [6|] that this Fuchs-Peres- 
Brandt (FPB) entangling probe can be implemented us- 
ing single-photon two-qubit (SPTQ) quantum logic in 
a proof-of-principle experiment. In SPTQ logic a sin- 
gle photon carries two independent qubits: the polariza- 
tion and the momentum (or spatial orientation) states of 
the photon. Compared to standard two-photon quantum 
gates, SPTQ gates are deterministic and can be efficiently 
implemented using only linear optical elements. We have 



previously demonstrated CNOT Q and SWAP Q gates in 
this SPTQ quantum logic platform. SPTQ logic affords 
a simple yet powerful way to investigate few-qubit quan- 
tum information processing tasks. 

In this work we use SPTQ logic to implement the FPB 
probe as a complete physical simulation of the most pow- 
erful attack on BB84, including physical errors. This is to 
our knowledge the first experiment on attacking BB84, 
and the results are in good agreement with theoretical 
predictions. It is only a physical simulation because the 
two qubits of a single photon carrier must be measured 
jointly, so that Eve needs access to Bob's receiver, but 
not his measurement. The SPTQ probe could become 
a true attack if quantum nondemolition measurements 
were available to Eve 0|. Nevertheless, the physical sim- 
ulation allows investigation of the fundamental security 
limit of BB84 against eavesdropping in the presence of 
realistic physical errors, and it affords the opportunity 
to study the effectiveness of privacy amplification when 
BB84 is attacked. 





FIG. 2: (Color online) Relations between different bases, (a) 
Control qubit basis for Eve's CNOT gate referenced to the 
BB84 polarization states, (b) iTo) and ]Ti) relative to the 
target qubit basis. 

In BB84, Alice sends Bob a single photon randomly 
chosen from the four polarization states of the horizontal- 
vertical (H-V) and ±45° {D-A) bases. In the FPB at- 
tack. Eve sets up her cnot gate with its control-qubit 
computational basis, {|0)c, |l)c}, given by 7r/8 rotation 
from the BB84 H-V basis, as shown in Fig.l^Ja), 
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Having selected the error probability, Pe , that she is will- 
ing to create, Eve prepares her probe qubit (cnot's tar- 
get) in the initial state 



lUn) = {{C + S)\0)t + {C^S)\1)t}/V2 
= cos6'i„|0)T + sin6'i„|l)T 



(2) 



where C = ^/l - 2Pe,S = V2P^, and {|0)t,|1)t} is 
the target qubit's computational basis. After the CNOT 
operation — with inputs from Alice's photon and Eve's 
probe — the two qubits become entangled. For each of 
Alice's four possible inputs, \H), \V), \D), and \A), the 
output of the CNOT gate is 

\H)mn) - \H,ut}^\H)\n) + \V)\TE), (3) 

\Vm,) - \V,^,)^\Vm) + \H)\TE), (4) 

\Dm,,) ^ \D,^,)^\D)\To)-\A)\Te), (5) 

|A)|Ti,) -> \A,^,)^\A)\T,)-\D)\Te), (6) 

where \To), Ti), and \Te) are defined in the target qubit's 
computational basis (see Fig.[2)Jb)) as: 
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Consider the case in which Bob measures in the same 
basis that Alice employed and his outcome matches what 
Alice sent. Then, according to Eqs. ©-([H]), the target 
qubit is projected into either jTo) or \Ti). After Alice 
and Bob compare their basis selections over the classical 
channel, Eve can learn about their shared bit value by 
distinguishing between the |To) and \Ti) output states of 
her target qubit. To do so, she employs the minimum 
error probability receiver for distinguishing between \Tq) 
and \Ti) by performing a projective measurement along 
|0)t and |1)t- Eve can then correlate the measurement 
of |0)t (|1)t) wfth |To) (iTi)). Note that this projec- 
tive measurement is not perfect unless |To) and \Ti) are 
orthogonal and hence coincide with the target's compu- 
tational basis, |0)t and |1)t. 

Of course. Eve's information gain comes at a cost: Eve 
has caused an error event whenever Alice and Bob choose 
a common basis and Eve's probe output state is \Te)- 
When Alice sent \H) and Bob measured in the H-V ba- 
sis, Eq. (IH) then shows that Alice and Bob will have an 
error event if the measured output state is |F)|T£;). The 
probability that this will occur is {Te\Te) = = Pe- 
For the other three cases in Eqs. (I4])"(l6|), the error event 
corresponds to the last term in each expression. There- 
fore the conditional error probabilities are identical, and 
hence Pe is the unconditional error probability. 

To quantify Eve's information gain, we use the Renyi 
information that she derives about the sift events in 
which Bob correctly measures Alice's qubit. Let B ~ 
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FIG. 3: Quantum circuit diagram for the FPB-probe attack. 
Photon 1 of a polarization-entangled singlet photon pair her- 
alds photon 2 and sets Eve's probe qubit to its initial state. 
The SWAP gate allows Alice's qubit to be set in the polar- 
ization mode of photon 2, whose momentum mode is Eve's 
probe qubit. The CNOT gate entangles Alice's qubit with 
Eve's qubit. Re, rotation by Eve; Ra, rotation by Alice; 



Rb, rotation by Bob; R 
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FIG. 4: (Color online) Experimental configuration for a com- 
plete physical simulation of the FPB attack on BB84. SPDC, 
spontaneous parametric down-conversion source; H, half-wave 
plate; Q, quarter-wave plate; P, polarizing beam splitter; D, 
single-photon detector. 



{0, 1} and E = {0, 1} denote the ensembles of possible 
bit values that Bob and Eve receive on an error-free sift 
event. The Renyi information (in bits) that Eve learns 
about each error-free sift event is 

In ^ -log, (E^'W ) (E^'(&|e)) , 



e=0 



(10) 

where {P{b), ^'(e)} are the a priori probabilities for Bob's 
and Eve's bit values, and P{b\e) is the conditional prob- 
ability for Bob's bit value to be b given that Eve's is 
e. According to Bayes' rule, P{b\e) can be calculated in 
terms of P{b, e) which is the probability of both Bob's 
bit to be b and Eve's bit to be e: 



P(6|e) = P(6,e)/EP(6,e), 



(11) 



6=0 



where P{b = 0, e) = |((i?| ® T(e|)|i?out)P and P{b = 
l,e) = |((y| (g) T(e|)|Vout)P in the case of B-V basis 
(|i?) corresponds to 6 = 0). A similar calculation for the 
D-A basis, with \D) corresponding to 6 then leads 
to the final result 



Iji = logs 1 



4Pg(l-2Pg) 
(1-W 



(12) 



Ideally, Eve's Renyi information is the same for both the 
H-V and D-A bases, but in actual experiments it may 
differ, owing to differing equipment errors in each basis. 
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TABLE I: Data samples, estimated probabilities, and theoretical values for D and A inputs with Bob using the same basis 
as Alice, and for predicted error probabilities Pe = 0,0.1, and 0.33. |0)|1) corresponds to Bob's measuring \D) and Eve's 
measuring 11)t. Column 1 shows the state Alice sent and column 2 shows the predicted error probability Pe- "Coincidence" 
columns show coincidence counts over a 40-s interval. "Estimated" columns show the measured coincidence counts normalized 
by the total counts of all four detectors, and "Expected" shows the theoretical values under ideal operating conditions. 



Figure [3] shows the quantum circuit diagram of our 
SPTQ implementation of the FPB probe. We start with 
a pair of polarization-entangled photons in the singlet 
state. Photon 1 is used as a trigger to herald photon 2 
as a single-photon pulse for the BB84 protocol. A swap 
operation applied to photon 2 exchanges its polarization 
and momentum qubits so that the polarization of photon 
1 and the momentum of photon 2 are now entangled in 
a singlet state. Eve encodes her probe qubit in the mo- 
mentum state of photon 2 by projecting photon 1 along 
an appropriate polarization state set by a polarization 
rotation Re. The polarization state of photon 2 after the 
SWAP gate is Alice's qubit, which is set by rotation Ra. 
Similarly, Bob's polarization analysis of Alice's qubit is 
set by Rb- The CNOT gate in Fig.[3]is preceded by a — 7r/8 
rotation and followed by a rotation because the ba- 

sis for the CNOt's control qubit is rotated by 7r/8 from the 
BB84 bases, as noted in Fig. [2] The CNOT gate that Eve 
employs is a polarization-controlled not (p-CNOt) gate 
that uses the polarization qubit as the control and the 
momentum qubit of the same photon as the target. We 
have previously demonstrated such a gate in a polariza- 
tion Sagnac interferometer with an embedded dove prism 
0. We have also demonstrated the swap operation Q 
by cascading three CNOT gates: a momentum-controlled 
NOT (m-CNOt), a P-CNOT, and another m-CNOT. 

Figure HI shows our experimental setup for implement- 
ing the quantum circuit. We used a bidirectionally 
pumped Sagnac interferometric down-conversion source 
Ini with a periodically poled KTiOP04 (PPKTP) crys- 
tal to generate polarization-entangled photons at 810 nm 
in the singlet state. The measured flux was ^700 pairs/s 
per mW of pump in a 1 nm bandwidth at ~99.45% visi- 
bility quantum interference. The coUimated output beam 
had a beam waist of wq = 0.53 mm. In a coUimated con- 
figuration, the momentum state of a photon is the same 
as the spatial orientation of the beam, which we use the 
right-left (R-L) basis in this experiment. The L and R 
beams were separated by ~2 mm. 

For each photon pair, photon 1 is used to herald the 
arrival of photon 2 and also to remotely control the mo- 
mentum qubit of photon 2 by postselection. Re polariza- 
tion rotation by Eve was implemented using a quarter- 



wave plate (QWP) Ql and a half-wave plate (HWP) HI, 
followed by single-photon detection (Dl) through a po- 
larizing beam splitter (PBS) PI along H. Ql was used 
to compensate an intrinsic phase shift ^ imposed by the 
SWAP gate on the target-qubit basis {|0)t, |1)t}- We 
have independently measured ^ ~ 88°. Therefore, the Re 
operation prepared the momentum qubit in \T(^) with a 
Ql-imposed phase shift ^ 

|T/„) = cos^i„|0)T + sin0in|l)T • (13) 

The extra phase shift of the swap gate would bring Eve's 
probe qubit to be in |Tin) of Eq. ^ 

After the SWAP gate, Ra and R-tt/s were combined in 
a single operation. The P-CNOT gate had the same phase 
shift problem as the SWAP gate, so we used a HWP (H2) 
and a QWP (Q2) to compensate for this phase shift and 
to impose the required rotation. After H2 and Q2 Alice's 
qubit becomes 

|*a) = cos0A|O)c + e'Xsin0A|l)c, (14) 

where x (— 98°) is the compensating phase shift and ^a 
is -22.5°, 22.5°, 67.5°, or 112.5° for \H),\D),\V) or \A), 
respectively, as shown in Fig. [2l^a). Similarly we com- 
bined Rtt/s and Rb into a single HWP (H3) in Fig.[5]and 
a PBS (P2) was used by Bob to analyze the polarization 
of Alice's qubit. 

Eve measured her qubit by a projective measurement 
along the |0)t-|1)t (spatially, R-L) basis. A HWP 
(H4/H5) was placed in the R or L beam path, as in- 
dicated in Fig. m so that the R and L beams would 
be distinguished by their orthogonal polarizations. This 
polarization tagging simplified their measurements by a 
PBS (P3/P4) and single-photon detectors. The four de- 
tectors uniquely identified the two qubits of photon 2. 
For example, D2 (D3) indicates R (L) for Eve's qubit, 
and either D2 or D3 suggests H polarization after Bob's 
analyzer. Therefore, in our physical simulation, the joint 
measurement by Bob and Eve yields Bob's polarization 
information and Eve's momentum information. 

In data collection, we measured coincidences between 
Dl and one of the detectors for photon 2. Table U shows 
two data sets for Alice's input of D and A polarizations 
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FIG. 5; (Color online) Eve's Renyi information Ir about 
Bob's error-free sifted bits as a function of error probability 
Pe that her eavesdropping creates. Solid squares, solid line: 
theoretical curve from Eq. (|12p . Solid diamonds, solid line: 
measured values for H-V basis. Solid triangles, solid line: 
measured values for D-A basis. Open diamonds, dashed line: 
fitted curve with error model for H-V basis. Open triangles, 
dashed line: fitted curve with error model for D-A basis. 



and compares with the expected values for the ideal case. 
From the raw data, we calculate the Renyi information 
Ir based on Eq. ([TO)) , and Fig. [5] plots Ir as a func- 
tion of the error probability Pe for the ideal case (solid 
squares, solid line), for the measured values with inputs 
in the H-V basis (solid diamonds, solid line), and for 
the measured values with inputs in the D-A basis (solid 
triangles, solid line). We note that no background counts 
were subtracted and the coincidence window was ~1 ns. 

In the ideal case with Pe — 0, Eve gets no information, 
Ir = 0, and Alice and Bob have no error bits. However, 
due to experimental errors such as imperfect gate fideli- 
ties, we measured ~5% of the sifted bits had errors. For 
Pe — 1/3, Eve obtains perfect information, Ir — 1, but 
in our experiment, Eve gained a maximum Ir = 0.9 or, 
on average. Eve gained 95% of the correct information 
about Bob's error-free sifted bits. 

To understand the errors involved in the experiment, 
we model our experimental setup with some non-ideal 



parameters. We assume that the phases ^ in Eq. (fT3)) 
and X ill Eq. (|14p could be inaccurate, and similarly for 
the setting of 6a in Eq. pi)) that might be caused by the 
wave plates. We also model the unitary p-CNOT gate as 
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where a = and 6 = for an ideal p-CNOT gate. Finally 
we assume that Bob's HWP (H3) setting oi 9b was not 
perfect such that 



\H) 



cos 61510)0 - sin 6l_B I l)c , 
> sin 6*510)0 + cos 6*511)0 , 



(16) 

|1/) ^sin0B|O)c+cos05|l)c, (17) 
where 9b should equal 22.5° (-22.5°) in the H-V (D-A) 
basis. 

We fit the data by minimizing the differences be- 
tween 96 measurements and the calculated numbers 
based on this error model. The fitting results show 
that ~ 3°, Ax ^ -11°, A9AiH,D,V,A) = 
{3.2°, 0.9°, -0.7°, -2.3°}, a = 12.3°, 6 = 3.6°, 
A9b{H/V,D/A) = {-1.8°, 0°}. As expected, the phase 
errors are relatively small and those associated with 9a 
and 9b are within the resolution of the rotating mounts 
housing the wave plates. The non-zero a also agrees with 
the measured classical visibility of 94% for the p-CNOT 
gate. We plot the fitted Ir based on this model in Fig. [5] 
for the H-V basis (open diamonds, dashed line) and the 
D-A basis (open triangles, dashed line). 

In summary, we have demonstrated experimentally the 
first complete physical simulation of the entangling-probe 
attack, showing that Eve can gain Renyi information of 
up to 0.9 under realistic operating conditions, including a 
CNOT gate that does not have an ultrahigh fidelity. Our 
results suggest the possible amount of information gain 
by Eve with current technology and the need to evaluate 
the required level of privacy amplification. 

This work was supported by BBN Technologies under 
the DARPA QuIST program. 
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